fix: align governance receipt freshness with commit lifecycle

.decapod/governance/claims.json

@@ -11,7 +11,7 @@
     "status": "active",
     "created_at": "2026-07-22",
     "updated_at": "2026-07-28",
-    "change_policy": "Claims are changed only through an issue-scoped review that preserves the baseline, Decapod condition, failure modes, measurements, proof gate, open questions, and evidence status. Governance artifact generation and publication inventory are tracked under issue #1025; the v0.85.0 cloud auto-login work for #1077 remains bounded to Decapod-owned backend composition, machine-local session reuse/refresh, repository identity, and CI surfaces while Propodus retains hosted authorization and persistence policy. One-time human GitHub approval, live protected todo behavior, and cross-system acceptance remain explicitly unproven follow-ups. The #1100/#1101/#1102 session lifecycle proof now covers local-session-first custody, machine-session reuse/refresh, pending-flow deduplication, one-time exchange persistence, and secret-free failure handling; deployment-provided live proof remains a protected follow-up. Hermes governance integrity and readiness substrate: issues #1094, #1096, #1059, #1055, and #1072. Propodus integration #766: bind cloud client repository scope to verified GitHub identity and prove the typed fake-service contract. Issue #1105: canonical Propodus cloud setup through decapod init; recovery guidance, machine-local custody, and compatibility behavior are covered by the implementation and focused tests. Issue #1105 publication proof: PR #1115 includes canonical init setup, machine-local custody behavior, redacted recovery guidance, and focused tests. Issue #1110 local datastore architecture: canonical .decapod/data/decapod.db now stores subsystem state in namespaced tables; this PR adds migration and proof coverage while preserving JSONL compatibility and deferring dactyl integration."
+    "change_policy": "Claims are changed only through an issue-scoped review that preserves the baseline, Decapod condition, failure modes, measurements, proof gate, open questions, and evidence status. Governance artifact generation and publication inventory are tracked under issue #1025; the v0.85.0 cloud auto-login work for #1077 remains bounded to Decapod-owned backend composition, machine-local session reuse/refresh, repository identity, and CI surfaces while Propodus retains hosted authorization and persistence policy. One-time human GitHub approval, live protected todo behavior, and cross-system acceptance remain explicitly unproven follow-ups. The #1100/#1101/#1102 session lifecycle proof now covers local-session-first custody, machine-session reuse/refresh, pending-flow deduplication, one-time exchange persistence, and secret-free failure handling; deployment-provided live proof remains a protected follow-up. Hermes governance integrity and readiness substrate: issues #1094, #1096, #1059, #1055, and #1072. Propodus integration #766: bind cloud client repository scope to verified GitHub identity and prove the typed fake-service contract. Issue #1105: canonical Propodus cloud setup through decapod init; recovery guidance, machine-local custody, and compatibility behavior are covered by the implementation and focused tests. Issue #1105 publication proof: PR #1115 includes canonical init setup, machine-local custody behavior, redacted recovery guidance, and focused tests. Issue #1110 local datastore architecture: canonical .decapod/data/decapod.db now stores subsystem state in namespaced tables; this PR adds migration and proof coverage while preserving JSONL compatibility and deferring dactyl integration. Issue #1109 receipt-freshness follow-up: the v0.89.2 catch-up preserves the falsifiable claims ledger while rebinding trajectory and validation receipts to the current commit lifecycle; the pre-commit git SHA equality is not treated as a valid invariant because the commit does not yet exist at validation time."
   },
   "scope": {
     "product": "decapod",

.decapod/governance/plan.json

@@ -1,17 +1,18 @@
 {
   "schema_version": "1.0.0",
-  "title": "Complete SQLite consolidation and event-table migration for #1118",
-  "intent": "Complete Issue #1118 within PR #1119: backend=local must use one canonical .decapod/data/decapod.db with all subsystem tables and append-only event tables; migrate legacy SQLite files and JSONL logs idempotently; stop new JSONL writes; and keep explicit dactyl integration out of this PR under dedicated issue #1120.",
+  "title": "Catch up PR #1109 receipt freshness on v0.89.2",
+  "intent": "Rebase the receipt-freshness fix from PR #1109 onto current v0.89.2 master, preserve receipt integrity and trajectory binding, remove the impossible pre-commit receipt git SHA equality requirement, add focused regression proof, refresh governed artifacts through Decapod, and push the updated PR #1109 branch.",
   "state": "APPROVED",
   "todo_ids": [
-    "bugs_01kyvkq975ekff0p"
+    "bugs_01kyvqgd6wepcpe8"
   ],
   "proof_hooks": [
     "cargo fmt --all -- --check",
     "cargo check --all-targets",
+    "cargo clippy --all-targets -- -D warnings",
     "cargo test --all-targets",
     "decapod validate",
-    "cargo test --test single_datastore"
+    "focused governance artifact tests"
   ],
   "unknowns": [],
   "human_questions": [],
@@ -20,8 +21,8 @@
   "deferred_questions": [],
   "constraints": {
     "forbidden_paths": [],
-    "file_touch_budget": 100
+    "file_touch_budget": 50
   },
   "phases": [],
-  "updated_at": "1785485784Z"
+  "updated_at": "1785489612Z"
 }

.decapod/governance/trajectory.json

@@ -1,57 +1,42 @@
 {
   "schema_version": "1.1.0",
-  "run_id": "validation_01KYVNVYKC1JR6ATWMPV703GF5",
-  "intent_id": "intent:validation_01KYVNVYKC1JR6ATWMPV703GF5",
-  "task_id": "bugs_01kyvkq975ekff0p",
-  "original_intent": "Produce proof artifacts for a repository validation completion.",
-  "derived_intent": "Run the bounded validation gates and bind the successful receipt to a trajectory.",
-  "destination": "validation completion",
+  "run_id": "run_01kyvqgd6wepcpe8",
+  "intent_id": "intent:run_01kyvqgd6wepcpe8",
+  "task_id": "bugs_01kyvqgd6wepcpe8",
+  "original_intent": "Catch up PR #1109 receipt freshness on Decapod v0.89.2",
+  "derived_intent": "Publish a focused receipt-freshness fix based on current master, with integrity, trajectory binding, regression proof, and passing governance validation",
+  "destination": "PR #1109",
   "current_phase": "validation",
   "next_transitions": [
     "publish"
   ],
   "active_boundaries": [
-    "Repository validation and tracked proof artifacts"
+    "Do not broaden into unrelated governance or dactyl work",
+    "Do not modify protected master directly"
   ],
   "repo_scope": [
-    ".decapod/governance/trajectory.json",
-    ".decapod/governance/validation.json"
+    "governed artifacts via Decapod CLI",
+    "src/decapod/core/governance_artifacts.rs",
+    "tests"
   ],
   "inspected_files": [],
   "modified_files": [
     ".decapod/governance/trajectory.json",
-    ".decapod/governance/validation.json",
-    "src/decapod/core/migration.rs"
+    ".decapod/governance/validation.json"
   ],
   "declared_commands": [
-    "cargo clippy --all-targets -- -D warnings",
-    "cargo test --test single_datastore",
-    "decapod validate",
-    "decapod validate --format json"
+    "decapod validate"
   ],
   "tool_calls": [],
   "checks": [
-    {
-      "name": "cargo_clippy",
-      "status": "passed"
-    },
     {
       "name": "decapod validate",
       "status": "passed"
-    },
-    {
-      "name": "decapod_validate",
-      "status": "passed"
-    },
-    {
-      "name": "legacy_schema_width_migration",
-      "status": "passed"
     }
   ],
   "evidence": [
-    "ci_failure=legacy federation_events target width mismatch;fix=intersection-column migration copy;validation_epoch=ve_5741a813a4d73036",
-    "validation epoch ve_5741a813a4d73036 completed with zero failures",
-    "validation epoch ve_8ec2ce3415249bba completed with zero failures"
+    "validation epoch ve_6f9c8095ab51dfe9 completed with zero failures",
+    "validation epoch ve_c0ba84da3cdcbf87 completed with zero failures"
   ],
   "shortcut_risk_signals": [],
   "unresolved_assumptions": [],
@@ -62,22 +47,24 @@
     "shortcut_risk": "supported",
     "completion_proof": "supported"
   },
-  "artifact_hash": "sha256:a2e70d777a969b91139720fb251b1e4d3e8d44fd0a7f2d7dc71c34b0d8c5e3a9",
+  "artifact_hash": "sha256:717a17ab6b0c9cee60a778320bfa2a789626c7e228eaaf7f49c12da48375f45f",
   "custody": {
     "schema_version": "1.0.0",
     "intents": {
-      "intent:validation_01KYVNVYKC1JR6ATWMPV703GF5": {
-        "id": "intent:validation_01KYVNVYKC1JR6ATWMPV703GF5",
-        "raw_intent": "Produce proof artifacts for a repository validation completion.",
-        "refined_intent": "Run the bounded validation gates and bind the successful receipt to a trajectory.",
+      "intent:run_01kyvqgd6wepcpe8": {
+        "id": "intent:run_01kyvqgd6wepcpe8",
+        "raw_intent": "Catch up PR #1109 receipt freshness on Decapod v0.89.2",
+        "refined_intent": "Publish a focused receipt-freshness fix based on current master, with integrity, trajectory binding, regression proof, and passing governance validation",
         "acceptance_criteria": [],
         "constraints": [
-          ".decapod/governance/trajectory.json",
-          ".decapod/governance/validation.json"
+          "src/decapod/core/governance_artifacts.rs",
+          "tests",
+          "governed artifacts via Decapod CLI"
         ],
         "assumptions": [],
         "boundaries": [
-          "Repository validation and tracked proof artifacts"
+          "Do not modify protected master directly",
+          "Do not broaden into unrelated governance or dactyl work"
         ],
         "out_of_scope": [],
         "proof_requirements": [],
@@ -90,62 +77,49 @@
       {
         "sequence": 2,
         "event_id": "event:2",
-        "intent_id": "intent:validation_01KYVNVYKC1JR6ATWMPV703GF5",
+        "intent_id": "intent:run_01kyvqgd6wepcpe8",
         "kind": "created"
       },
       {
         "sequence": 3,
         "event_id": "event:3",
-        "intent_id": "intent:validation_01KYVNVYKC1JR6ATWMPV703GF5",
+        "intent_id": "intent:run_01kyvqgd6wepcpe8",
         "kind": "refined"
       },
       {
         "sequence": 4,
         "event_id": "event:4",
-        "intent_id": "intent:validation_01KYVNVYKC1JR6ATWMPV703GF5",
+        "intent_id": "intent:run_01kyvqgd6wepcpe8",
         "kind": "trajectory_step_recorded",
-        "detail": "trajectory:validation_01KYVNVYKC1JR6ATWMPV703GF5"
+        "detail": "trajectory:run_01kyvqgd6wepcpe8"
       },
       {
         "sequence": 5,
         "event_id": "event:5",
-        "intent_id": "intent:validation_01KYVNVYKC1JR6ATWMPV703GF5",
+        "intent_id": "intent:run_01kyvqgd6wepcpe8",
         "kind": "trajectory_step_recorded",
-        "detail": "trajectory:validation_01KYVNVYKC1JR6ATWMPV703GF5"
-      },
-      {
-        "sequence": 6,
-        "event_id": "event:6",
-        "intent_id": "intent:validation_01KYVNVYKC1JR6ATWMPV703GF5",
-        "kind": "trajectory_step_recorded",
-        "detail": "trajectory:validation_01KYVNVYKC1JR6ATWMPV703GF5"
-      },
-      {
-        "sequence": 7,
-        "event_id": "event:7",
-        "intent_id": "intent:validation_01KYVNVYKC1JR6ATWMPV703GF5",
-        "kind": "trajectory_step_recorded",
-        "detail": "trajectory:validation_01KYVNVYKC1JR6ATWMPV703GF5"
+        "detail": "trajectory:run_01kyvqgd6wepcpe8"
       }
     ],
     "trajectories": {
-      "validation_01KYVNVYKC1JR6ATWMPV703GF5": {
-        "id": "validation_01KYVNVYKC1JR6ATWMPV703GF5",
-        "intent_id": "intent:validation_01KYVNVYKC1JR6ATWMPV703GF5",
+      "run_01kyvqgd6wepcpe8": {
+        "id": "run_01kyvqgd6wepcpe8",
+        "intent_id": "intent:run_01kyvqgd6wepcpe8",
         "evidence_only": true,
         "steps": [
           {
             "sequence": 4,
             "action": "validation",
             "command": "decapod validate",
             "scope": [
-              ".decapod/governance/trajectory.json",
-              ".decapod/governance/validation.json"
+              "governed artifacts via Decapod CLI",
+              "src/decapod/core/governance_artifacts.rs",
+              "tests"
             ],
             "observations": [
               ".decapod/governance/trajectory.json",
               ".decapod/governance/validation.json",
-              "validation epoch ve_8ec2ce3415249bba completed with zero failures"
+              "validation epoch ve_6f9c8095ab51dfe9 completed with zero failures"
             ],
             "proof_refs": [
               "decapod validate"
@@ -158,64 +132,26 @@
             "action": "validation",
             "command": "decapod validate",
             "scope": [
-              ".decapod/governance/trajectory.json",
-              ".decapod/governance/validation.json"
+              "governed artifacts via Decapod CLI",
+              "src/decapod/core/governance_artifacts.rs",
+              "tests"
             ],
             "observations": [
               ".decapod/governance/trajectory.json",
               ".decapod/governance/validation.json",
-              "validation epoch ve_5741a813a4d73036 completed with zero failures"
+              "validation epoch ve_c0ba84da3cdcbf87 completed with zero failures"
             ],
             "proof_refs": [
               "decapod validate"
             ],
             "validation_findings": [],
             "custody_event_id": "event:5"
-          },
-          {
-            "sequence": 6,
-            "action": "validation",
-            "command": "decapod validate",
-            "scope": [
-              ".decapod/governance/trajectory.json",
-              ".decapod/governance/validation.json"
-            ],
-            "observations": [
-              ".decapod/governance/trajectory.json",
-              ".decapod/governance/validation.json",
-              "validation epoch ve_5741a813a4d73036 completed with zero failures"
-            ],
-            "proof_refs": [
-              "decapod validate"
-            ],
-            "validation_findings": [],
-            "custody_event_id": "event:6"
-          },
-          {
-            "sequence": 7,
-            "action": "validation",
-            "command": "cargo clippy --all-targets -- -D warnings",
-            "scope": [
-              ".decapod/governance/trajectory.json",
-              ".decapod/governance/validation.json"
-            ],
-            "observations": [
-              "src/decapod/core/migration.rs",
-              "ci_failure=legacy federation_events target width mismatch;fix=intersection-column migration copy;validation_epoch=ve_5741a813a4d73036"
-            ],
-            "proof_refs": [
-              "legacy_schema_width_migration",
-              "cargo_clippy",
-              "decapod_validate"
-            ],
-            "validation_findings": [],
-            "custody_event_id": "event:7"
           }
         ]
       }
     },
     "summaries": {},
     "knowledge_candidates": [],
-    "next_sequence": 7
+    "next_sequence": 5
   }
 }